I have already looked at the MS Knowledge Base answer stated as a 'solution' to Allpurple s problem titled "Login method has changed...". It does not appear to actually solve that problem, nor does it solve mine. The problem occurs ON STARTUP, before trying to start an Office 2003 application. Also, I have SP2 installed, as well as subsequent updates, so I would think that "re-installing SP1a" would be a step in the wrong direction.

I am able to select different users at the first login box, and get the appropriate desktop for each, but the error which comes up before any icons appear is the same in all cases (see title). After clicking on OK, there is no response of any kind. CTRL+ALT+DEL has no effect.

Hi the real solution:
perform a reinstallation of Windows XP, sometimes called a repair installation? Will not harm your current files.
definately donot re-install sp1a it wont install anyway.

Configure your computer to start from the CD-ROM drive. For more information about how to do this, refer to your computer's documentation or contact your computer manufacturer. Then insert your Windows XP Setup CD, and restart your computer.

1.
When the Press any key to boot from CD message is displayed on your screen, press a key to start your computer from the Windows XP CD.
Press ENTER when you see the message To setup Windows XP now, and then press ENTER displayed on the Welcome to Setup screen.
Do not choose the option to press R to use the Recovery Console.
In the Windows XP Licensing Agreement, press F8 to agree to the license agreement.
Make sure that your current installation of Windows XP is selected in the box, and then press R to repair Windows XP.
Follow the instructions on the screen to complete Setup
============================================
Check in control panel administrative tools event viewer applications errors id the number for an event woudlbe great to see... and any logs.
Look into system devices for yellow questions marks.
Run the disc cleanup utility at start all programs accessories system tools.
at start run type in CMD press enter>>type in> sfc /scannow
Defrag chkdsk.
Check for malware.
How old is your computer?
The jell under the processor maybe dried out.
Memory may not be sufficient or have a problem
PSU may not be supplying continous power and also may not be enough, as we keep adding stuff to the computer the origianl PSU becomes laboured. xpsp2 uses a lot of processor ..

Open Hijackthis, click scan and save a logfile" donot fix" to the desktop or
then navigate to the hijackthis folder and copy out the log file
contents and paste the log here into the small windows or panel>> http://www.hijackthis.de/
look directly below the panel or window see the small analyze

once you hit analyze it will analyse it immediately
you will know by the fact the panel is now empty
just scroll down below this now empty panel and you can see your analysed log,
right at the bottom below your analyzed log is the option to save it.
Please click on this save it.
Copy this address/url and paste it here.

Yesterday, just before noon, one user successfully logged in, accessed e-mail, played a few games, etc. with no apparent problems. At about 9:45 p.m., I tried to start IE and got the error message shown.

I agree with scanning with Hijackthis to eliminate malware and viruses/trojans etc but let us look at the logfile first without anything being fixed yet.
Also when you scan with Hijackthis make sure all startup entries are checked so all programs that runs at startup will show in the log.

You can paste hijackthis log to either of these sites:http://www.rafb.net/paste/
then at the bottom left corner click "paste"
Copy the address/url and post it here:

Or paste the log at --> http://www.hijackthis.de/
and click "Analyse", click "Save". Then post the link to the saved list here.

Merete - can we chat instead of posting comments here? I was re-installing Windows, as you recommended. Several files were not able to be installed from the CD: kerberos.dll, es.dll, cdosys.dll and mshtmled.dll. After retrying each of these one, without success, I pressed ESC to skip it and continue with the Setup. It finished copying all files, then rebooted to 'finish the setup process' BUT I got a "FATAL ERROR - An error has been encountered that prevents Setup from continuing. One of the components that Windows needs to continue setup could not be installed. Data error (cyclic redundancy check).

After viewing the Setup error log, I clicked OK. System rebooted, and tried to resume Setup, with the same result. Now what?
I can't do anything else you suggested above, such as accessing the control panel or disk cleanup, or downloading Hijackthis, since I can't get Windows up!!

BTW, I have two computers - I am using the old slow one to pursue this conversation. The newer one is a P4 I purchased in January 2005, custom built at MicroCenter.

ok this time when it boots to cd press any key to start setup, choose R for recovery when it get to which windows
use the CMD prompt here type in chkdsk /r note teh gap press enter
let it run until it returns to the cmd prompt. take out the xpcd then type in exit press enter
it will reboot tapf8 continously in the advanced options screen look down the list choose last known good config that worked press enter it will reboot.

correction
ok this time when it boots to cd press any key to start setup, choose R for recovery when it get to which windows
use the CMD prompt here type in chkdsk /r note the gap press enter
let it run until it returns to the cmd prompt then type in fixboot C: press enter
take out the xpcd then type in exit press enter
it will reboot tapf8 continously in the advanced options screen look down the list choose last known good config that worked press enter it will reboot.

Well, now You've done it, I suggest You do a clean format and reinstall, unless You had some very important data on that PC, if so, then You can copy it over to the old PC, just connect the HDD to the old PC from Your new one.

Anyway, there is a very little hope, that You will fix the current Windows installation without any flaws later.

StillUnAware please dont do that it shows your lack of. I'll help JeffNPlano with this one if thats ok with you
otherwise we'll go to private emails instead and I'll guide him back.
Thank you though.
Regards Merete

Merete - I COULDN'T run the Hijckthis first!!!!! As I explained, I can't get to ANYTHING such as Internet downloads through Windows. I FINALLY was able to get to the "chkdsk /r " and it is running now but very slowly. BTW, I am NOT off work today and will need to stop working on this in about 2 hours from now.

Ok thank you.
actually I was going to ask you about your work time.
We can continue this later if you like. If you prefer email click onmy name.. I can take you thru the steps. But I believe you have some nasties there. It is these that is causing the problems. I listed some downloads to replace dlls. above we may have download them after its cleaned out and install them to replace the damaged dlls.

I'll have to wait for the chkdsk to finish, what I do with these situations is to slave it. Then remove the malware while its slaved. As windows is nolonger running all files are open.
I simply use the cdrom ide and power connector and plug these into the hdd, move the pin on the rear to slave, unplug the power though this very imprtant dont just shutdown but unpower as well.

scan the slaved drive with hijackthis and a few good spyware removers
adaware
stinger is great
or go online and get house calls to run a scan on this Drive while slaved

You should be able to fix this with no loss of files.
What is the computer specs you on now?
You say it is slow does it have xp? Just wondering if it has the power to pull 2 hdd.

BTW when the chkdsk finishes which could take a while, instead of choosing last known good config tapf8
yes but see if you can into safemode Choose safemode with networking.
choose the administrative account xp has a hidden adminaccount even though youare the admin. press enter if it asks for a password.
We may be able scan it with your anti virus and delete a few things associated with the malware to stop it.

I am very uneasy at the thought of doing ANY hardware modifications, especially with the delay between messages and the imprecise nature of verbal descriptions. I MAY need to get a tech here to help with this. I can decide later.

Backup any data in any location: local and remote systems, physical and virtual servers, private and public clouds, Macs and PCs, tablets and mobile devices, & more! For limited time only, buy any Acronis backup products and get a FREE Amazon/Best Buy gift card worth up to $200!

I am in Texas, close to Dallas. It is 10:21 a.m. Monday here. CHKDSK is only up to 65%; it was on 60% for at least 9 minutes, then about 3-5 minutes per additional % point.

After I leave this "morning" (for me), I will not be back for about 10 hours (8:30 p.m. CDT), and I will be unavailable tomorrow from 8:00 a.m. on, then not available until Wednesday evening after 7:00 CDT.

The Del would be fine JeffNPlano I agree if your not comfortable..mlaware is causes some damage.
Your windows should still be ok it is just the malware causing this now, as you onlyran a repair this will not have damaged your windows but depending what trojans or malware they may have. But those links can be extracted to replace teh damaged dlls I have done this onthe most dead infected computers and still managed to restore the pc back to the clien intact :)
but if you can get into safemode you could clean out some of the malware straight up,
ok here's what you can do in safemode if you get in there later.

firstly run the task manager and look for any sus running programs and stop them, if they are running they prevent you from using certain programs.
delete all the temporary internet files history cookies. The disc cleanup does this as well.
System restore will have to be deleted by dis-abling it this deletes the restore points the trojans hide in them.You can re-enable it later, good policy to do this occasionally.

run the virus any spyware programs you have installed.
delete the contents of the temp folder they hide inhere as well.
C:\Documents and Settings\Administrator\Local Settings\Temp
empty the recycle bin they hide in here as well
delete emails and empty the recycle bin same here.
then from start run type in sfc /scannow it may ask you for the xpcd.

I would say when the friend opened his/her emails it had a nastie ..emails and attachments are the hightest entry points for trojans worms etc.
Merete

its checking back and forth I guess, let it run it will just keep going but its doing good hopefully.
without knowing what the malware is it has probably changed your regestry, trojans and worms rewrite the regestry that is why there is patches for the regestry to prevent them from doing this.
So I acnnot garrantee safemode will remove all the infection.
We have had several real nasties lately worms that prevents windows from starting once it has been shutdown.
Texas yeha long way away we are :)

justr re-reading
I am very uneasy at the thought of doing ANY hardware modifications.No hardware modifications, just slaving the hdd, if you have never done this then agree give it to a teckie.

"especially with the delay between messages and the imprecise nature of verbal descriptions" ,>> hense the email offer as i could supply snaps and pictures.
but it is simple to do, all you need is 3 tools really, A screw driver to take off the case side lid.
one pair of tweezer to move the pin on the rear of the hdd, however I would have asked you check if it is set to cable select, if it is then no need to move the pin to slave position... on the top of the hdd is a diagram that shows the positions there is three cable select/ slave and master..
a small flat nosed pliers make it easier to pull out the ide cable and power connector behind the hdd on the infected machine and the cdrom on the old computer.
I do entirely understand, I also run computer classes for high schoolies and am very aware of what it must feel like staring at the prospect of doing what I call easy :)

ok will do but everyone does this otherwise why put their emails in the account?
I have always pasted back the comments even though they were brief, and the asker always finalises his question with the his solution.
I have gone to emails for now so that I can provide snapshots of the steps using my own computer I cannot do this here, I believed we could at the EE stuff
but War1 has explained to me that is not to be used for that .
You know slaving a hdd is just three steps the rest I have posted here.
Besides he is at work now and we are at opposite times of day and night.
Cheers Merete

Thanks for being so cooperative Merete, and I do understand your point.
You know that I had to inform you about the guidelines otherwise the staff/admins/mods will tell me off for ignoring it.
I hope you understand why I posted that comment, :)

I do entriely and I do agree as well.
I have to be careful how I word things too, I was only referring to sending him some snaps for that extra bit of security as he has not done this before, I also suggested if he was not sure do take it to a teckie... I have to wait now for him to come home from work to progress to the slave, he will just scan the hdd in slave for malware thats all.
I use the references and solutions of others myself. :)
I donot use any kind of extra means to gain points as I am not even in this for points but to learn and share.
==============================
Comment from JeffNPlano
Date: 06/27/2006 01:28AM EST
Author Comment
I am in Texas, close to Dallas. It is 10:21 a.m. Monday here. CHKDSK is only up to 65%; it was on 60% for at least 9 minutes, then about 3-5 minutes per additional % point.

After I leave this "morning" (for me), I will not be back for about 10 hours (8:30 p.m. CDT), and I will be unavailable tomorrow from 8:00 a.m. on, then not available until Wednesday evening after 7:00 CDT.
===============================================================

ok to update
Jeff emailed me and stated his computer rebooted after the repair but went back to setup must continue, he then rebooted it and it works fine, I then suggested that it may not be ok just yet, we looked at his boot.ini and it was wrong so have corrected it, the machine now boots fine and reboots, however there is a new problem no curser, so as I suspected there is malware before the repair I explained that a repair will not fix any malware he is now running the hijackthis. and will post the log here.
Merete

I don't see any obvious malware entries in the log,
these ones below seem suspicious but he probably know what they are:
WorldCommunityGrid
FreezeScreenSaver.exe

Sometimes malware does not show up in the hijackthis scan.
Can he run more diagnostic tools like Blacklight and silent runners?

1. Please download Silent Runners.http://www.silentrunners.org/Silent%20Runners.vbs
* Save it to the desktop.
* Run Silent Runner's by doubleclicking the "Silent Runners" icon on your desktop.
* You will see a text file appear on the desktop - it's not done yet, just let it run (it won't appear to be doing anything!)
* Once you receive the prompt "All Done!", double-click on the new text file on the desktop and copy that entire log and upload the logfile created, go here and paste your log, http://www.rafb.net/paste/
then at the bottom left corner click "paste"
Copy the address/url and post it here:

*NOTE* If you receive any warning message about scripts, please choose to allow the script to run.

You'll see a list of all the items it found. There will also be a log on your desktop with the name fsbl.xxxxxxx.log (where xxxxxxx represents numbers). The application finds both bad files and legitimate ones such as "wbemtest.exe", so don't choose the rename option yet! Copy and paste the log it generated in your next reply.

Thank you rpggamergirl and Merete. My original problem seems to be fixed, or at least the main symptom is gone. I can get into Windows in the usual way, to any user. BUT I cannot select any enterable fields (input boxes) such as in hotmail, or on bank or brokerage login screens. My mouse is working; rollover highlighting and click-to-select work fine. I will try Silent Runners and Blacklight later, possibly tomorrow, more likely the next day, due to my work schedule. I have been up over 20 hours now, and need to be up again in just under 5 hours, so I need to go to bed now.

I downloaded Silent Runners and saved it to my desktop as instructed. HOWEVER, when I clicked on it, and selected 'Open', I got a popup error message that said "WMI Service not running. This script requires Windows Management Instrumentation to run. Click on Start, ControlPanel, Administrative Tools, Services, and start the "Windows Managment Instrumentation" service. I tried to do this, but when I clicked on Services I got TWO overlayed error messages. The first (lower) one says "Internet Explorer Script Error An error has occurred in the script on this page. However, further down in the box, the Line:, Char:, Error:, Code:, and URL: lines are all unpopulated. On top of this error message, I got another, smaller message which said "Microsoft Internet Explorer An error has occurred in this dialog. Error: 30 Unspecified error. After clicking on OK, I was able to scroll down the list of Services and select WMI. I then got the same error 30. I clicked on OK again, and was able to start the WMI service (it shows "Started" in the list). When I went back to the Desktop to click on Silent Runners, it still says "WMI Service not running". Please advise.

Most of the time we are in fix when all of sudden our systems behave weirdly. Such problems cost time and effort... so it's best to take some preventive actions so that we can avoid such issues or overcome such problems more easily.
Preventive M…

There are 2 things you must have in order to connect to the internet behind a router, The "Gateway IP" of the router, which is usually something like 192.168.xxx.1, I've seen routers with default values of: 192.168.0.1,
192.168.1.1,
192.168.11.1,
…

This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg).
If you're looking for how to monitor bandwidth using netflow or packet s…